Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover GHSA-2r2v-9pf8-6342, GO-2025-3371 | High | Not scored | 07 Jan, 2025 | Go github.com/h44z/wg-portal |
go-git clients vulnerable to DoS via maliciously crafted Git server replies CVE-2025-21614, GHSA-r9px-m959-cxf4, GO-2025-3367 | High | 0.7% | 06 Jan, 2025 | Go github.com/go-git/go-git Go github.com/go-git/go-git/v4 Go github.com/go-git/go-git/v5 Go gopkg.in/src-d/go-git.v4 |
go-git has an Argument Injection via the URL field CVE-2025-21613, GHSA-v725-9546-7q7m, GO-2025-3368 | Critical | 1.3% | 06 Jan, 2025 | Go github.com/go-git/go-git/v4 Go github.com/go-git/go-git/v5 Go gopkg.in/src-d/go-git.v4 |
SiYuan has an arbitrary file deletion vulnerability CVE-2025-21609, GHSA-8fx8-pffw-w498, GO-2025-3362 | High | 0.6% | 03 Jan, 2025 | Go github.com/siyuan-note/siyuan/kernel |
Karmada Tar Slips in CRDs archive extraction CVE-2024-56514, GHSA-cwrh-575j-8vr3, GO-2025-3363 | Medium | 0.8% | 03 Jan, 2025 | Go github.com/karmada-io/karmada |
Karmada PULL Mode Cluster Privilege Escalation CVE-2024-56513, GHSA-mg7w-c9x2-xh7r, GO-2025-3364 | High | 0.5% | 03 Jan, 2025 | Go github.com/karmada-io/karmada |
OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation CVE-2024-25133, GHSA-wgqq-9qh8-wvqv, GO-2024-3360 | High | 0.5% | 31 Dec, 2024 | Go github.com/openshift/hive |
Navidrome Stores JWT Secret in Plaintext in navidrome.db CVE-2024-56362, GHSA-xwx7-p63r-2rj8, GO-2024-3357 | High | 0.2% | 23 Dec, 2024 | Go github.com/navidrome/navidrome |
SQL injection in Apache Traffic Control CVE-2024-45387, GHSA-vq94-9pfv-ccqr, GO-2024-3358 | High | 65.4% | 23 Dec, 2024 | Go github.com/apache/trafficcontrol Go github.com/apache/trafficcontrol/v8 |
Path Traversal in file update API in gogs CVE-2024-55947, GHSA-qf5v-rp47-55gg, GO-2024-3356 | High | 77.8% | 23 Dec, 2024 | Go gogs.io/gogs |
Remote Command Execution in file editing in gogs CVE-2024-54148, GHSA-r7j8-5h9c-f6fx, GO-2024-3355 | High | 0.9% | 23 Dec, 2024 | Go gogs.io/gogs |
GoCast OS Command Injection vulnerability CVE-2024-28892, GHSA-5qww-56gc-f66c, GO-2024-3359 | Critical | 6.5% | 20 Dec, 2024 | Go github.com/mayuresh82/gocast |
Hashicorp Nomad Incorrect Privilege Assignment vulnerability CVE-2024-12678, GHSA-hr68-hvgv-xxqf, GO-2024-3354 | Medium | 0.5% | 20 Dec, 2024 | Go github.com/hashicorp/nomad |
GoPhish sends cleartext passwords CVE-2024-55196, GHSA-rv83-h68q-c4wq, GO-2025-3361 | High | 0.4% | 19 Dec, 2024 | Go github.com/gophish/gophish |
OpenShift Must Gather Operator Improper Input Validation vulnerability CVE-2024-25131, GHSA-77c2-c35q-254w, GO-2024-3349 | High | 0.8% | 19 Dec, 2024 | Go github.com/openshift/must-gather |
WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service GHSA-5pf6-cq2v-23ww, GO-2024-3350 | High | Not scored | 19 Dec, 2024 | Go github.com/clidey/whodb/core |
Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2024-45338, GHSA-w32m-9786-jp63, GO-2024-3333 | High | 1.1% | 18 Dec, 2024 | Go golang.org/x/net Go golang.org/x/net/html |
age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution GHSA-32gq-x56h-299c, GO-2024-3344 | Medium | Not scored | 18 Dec, 2024 | Go filippo.io/age |
Open Cluster Management vulnerable to Trust Boundary Violation CVE-2024-9779, GHSA-jhh6-6fhp-q2xp, GO-2024-3343 | High | 0.4% | 18 Dec, 2024 | Go open-cluster-management.io/ocm |
Traefik affected by CVE-2024-53259 GHSA-hxr6-2p24-hf98, GO-2024-3342 | Medium | Not scored | 17 Dec, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
ASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a stack overflow or resource exhaustion GHSA-8wcc-m6j2-qxvm, GO-2024-3339 | High | Not scored | 16 Dec, 2024 | Go cosmossdk.io/x/tx Go github.com/cosmos/cosmos-sdk |
MinIO vulnerable to privilege escalation in IAM import API CVE-2024-55949, GHSA-cwq8-g58r-32hg, GO-2024-3336 | High | 0.6% | 16 Dec, 2024 | Go github.com/minio/minio |
Mattermost Race Condition vulnerability CVE-2024-48872, GHSA-826h-p4c3-477p, GO-2024-3338 | Medium | 0.3% | 16 Dec, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Improper Validation of Specified Type of Input vulnerability CVE-2024-54083, GHSA-69pr-78gv-7c6h, GO-2024-3337 | Medium | 0.6% | 16 Dec, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Data Amplification vulnerability CVE-2024-54682, GHSA-v647-h8jj-fw5r, GO-2024-3340 | Medium | 0.4% | 16 Dec, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Full access to the host's OS file system using osfs.FS with Router.Static in goyave.dev/goyave/v5 GO-2024-3293 | Not scored | 13 Dec, 2024 | Go goyave.dev/goyave/v5 | |
Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service CVE-2024-12289, GHSA-xx83-cxmq-x89m, GO-2024-3335 | Medium | 0.4% | 13 Dec, 2024 | Go github.com/hashicorp/boundary |
Beego has Collision Hazards of MD5 in Cache Key Filenames CVE-2024-55885, GHSA-9j3m-fr7q-jxfw, GO-2024-3331 | Medium | 0.3% | 12 Dec, 2024 | Go github.com/beego/beego Go github.com/beego/beego/v2 |
Potential Vulnerabilities Due to Outdated golang.org/x/crypto Dependency in NanoProxy GHSA-7prj-hgx4-2xc3, GO-2024-3330 | High | Not scored | 12 Dec, 2024 | Go github.com/ryanbekhen/nanoproxy |
SiYuan has an arbitrary file read via /api/template/render CVE-2024-55657, GHSA-xx68-37v4-4596, GO-2024-3327 | High | 0.7% | 11 Dec, 2024 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources CVE-2024-55658, GHSA-25w9-wqfq-gwqx, GO-2024-3323 | High | 0.6% | 11 Dec, 2024 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan has an arbitrary file write in the host via /api/asset/upload CVE-2024-55659, GHSA-fqj6-whhx-47p7, GO-2024-3326 | High | 0.4% | 11 Dec, 2024 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan has an SSTI via /api/template/renderSprig CVE-2024-55660, GHSA-4pjc-pwgq-q9jp, GO-2024-3324 | Medium | 0.6% | 11 Dec, 2024 | Go github.com/siyuan-note/siyuan/kernel |
kcp's impersonation allows access to global administrative groups GHSA-c7xh-gjv4-4jgv, GO-2024-3325 | Medium | Not scored | 11 Dec, 2024 | Go github.com/kcp-dev/kcp |
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45337, GHSA-v778-237x-gjrc, GO-2024-3321 | Critical | 3.2% | 11 Dec, 2024 | Go golang.org/x/crypto |
CosmWasm VM Incorrect metering GHSA-2q97-m5rc-p3gp | Medium | Not scored | 10 Dec, 2024 | Go github.com/CosmWasm/wasmvm Go github.com/CosmWasm/wasmvm/v2 crates.io cosmwasm-vm |
Panic in wasmvm can slow down block production GHSA-vmqh-5232-v43r | Medium | Not scored | 10 Dec, 2024 | Go github.com/CosmWasm/wasmvm Go github.com/CosmWasm/wasmvm/v2 crates.io cosmwasm-vm |
Simulation of Wasmd message can cause crashing GHSA-vmg2-r3xv-r3xf, GO-2024-3319 | Low | Not scored | 10 Dec, 2024 | Go github.com/CosmWasm/wasmd |
unstructured XML External Entity (XXE) CVE-2024-46455, GHSA-32r8-54hf-c9p3, GO-2024-3315, PYSEC-2026-1993 | Critical | 0.6% | 09 Dec, 2024 | Go github.com/Unstructured-IO/unstructured PyPI unstructured |
Hugo does not escape some attributes in internal templates CVE-2024-55601, GHSA-c2xf-9v2r-r2rx, GO-2024-3314 | Medium | 0.6% | 09 Dec, 2024 | Go github.com/gohugoio/hugo |
lxd CA certificate sign check bypass CVE-2024-6156, GHSA-4c49-9fpc-hc3v, GO-2024-3312 | Low | 0.2% | 09 Dec, 2024 | Go github.com/canonical/lxd |
lxd has a restricted TLS certificate privilege escalation when in PKI mode CVE-2024-6219, GHSA-jpmc-7p9c-4rxf, GO-2024-3313 | Low | 0.2% | 09 Dec, 2024 | Go github.com/canonical/lxd |
CVE-2024-50948 in github.com/mochi-mqtt/server CVE-2024-50948, GO-2024-3307 | 0.6% | 04 Dec, 2024 | Go github.com/mochi-mqtt/server | |
Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability CVE-2024-54132, GHSA-2m9h-r57g-45pj, GO-2024-3310 | Medium | 0.6% | 04 Dec, 2024 | Go github.com/cli/cli Go github.com/cli/cli/v2 |
Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3) CVE-2024-54131, GHSA-66q9-2rvx-qfj5, GO-2024-3308 | High | 0.2% | 03 Dec, 2024 | Go github.com/kolide/launcher |
Vitess allows HTML injection in /debug/querylogz & /debug/env CVE-2024-53257, GHSA-7mwh-q3xm-qh6p, GO-2024-3306 | Medium | 0.4% | 03 Dec, 2024 | Go vitess.io/vitess |
BunkerWeb has Open Redirect Vulnerability in Loading Page CVE-2024-53264, GHSA-q9rr-h3hx-m87g, GO-2024-3294 | Medium | 0.8% | 02 Dec, 2024 | Go github.com/bunkerity/bunkerweb |
Access to Archived Argo Workflows with Fake Token in `client` mode BIT-argo-workflows-2024-53862, CVE-2024-53862, GHSA-h36c-m3rf-34h9, GO-2024-3303 | Medium | 0.7% | 02 Dec, 2024 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
quic-go affected by an ICMP Packet Too Large Injection Attack on Linux CVE-2024-53259, GHSA-px8v-pp82-rcvr, GO-2024-3302 | Medium | 0.6% | 02 Dec, 2024 | Go github.com/quic-go/quic-go |
sftpgo vulnerable to brute force takeover of OpenID Connect session cookies CVE-2024-52801, GHSA-6943-qr24-82vx, GO-2024-3300 | Medium | 0.4% | 02 Dec, 2024 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |